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During the past few decades, NASA Langley Research Center (LaRC) has supported several 
large-scale failure and incident investigations and numerous requests for engineering 
consultations. Although various extenuating circumstances contributed to each of these incidents, 
in all cases, the failure resulted from accumulation and/or propagation of damage that reduced the 
load carrying capability of the structure to a level below that which was needed to sustain 
structural loads. A brief overview of various failure and incident investigations supported by 
LaRC, including some of the computational and experimental methodologies that have been 
applied, is presented. An important outcome of many of these failure and incident investigations is 
the development of an improved understanding of not only the state-of-the-art in experimental and 
analytical methods but also the state-of-the-art in the design and manufacturing processes that may 
contribute to such failures. In order to provide insight into such large-scale investigations, a series 
of lessons learned were captured. Awareness of these lessons learned is highly beneficial to 
engineers involved in similar investigations. Therefore, it is prudent that the lessons learned are 
disseminated such that they can be built upon in other investigations and in ensuing research and 
development activities. 


I. Introduction 

D uring the past few decades, NASA Langley Research Center (LaRC) has been called upon to support 
several large-scale failure and incident investigations and numerous requests for engineering consultations. 
Among the most notable of the failure investigations are the American Airlines Flight 587 accident, the X- 
33 liquid hydrogen tank failure, and the Space Shuttle Columbia accident. Numerous members of LaRC’s research 
and engineering staff, technician workforce, and support personnel, representing virtually every engineering and 
scientific discipline on the Center, participated in these investigations. Additionally, many of these same personnel 
routinely support requests for analysis, experimental interrogation or expert opinion made by various branches of 
the military, Coast Guard, and US industry. Since large-scale failure investigations tend to be the more challenging 
and comprehensive than routine engineering inquiries, the focus of the remainder of this paper is on these 
investigations. Figures 1, 3, and 5 illustrate three of the most recent large-scale failure investigations supported by 
LaRC. 


This paper will present a discussion of the lessons learned during the course of the aforementioned failure 
and incident investigations. First, a brief overview of the investigations will be presented, including an overview of 
some of the computational and experimental methodologies that were used during the investigations. In some 
instances, state-of-the-art methods were applied with no modification, while in others, enhanced or specialized 
methods were used. An important outcome of many of these failure and incident investigations is an improved 
understanding of not only the state-of-the-art in experimental and analytical methods but also the state-of-the-art in 
the design and manufacturing processes that may contribute to such failures. Next, emphasis is placed on current 
and future requirements for durability and damage tolerance of aerospace structures as determined during the 
investigations. Finally, a discussion of the lessons learned from the various failure investigations is presented. 
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II. Three Major Failure Investigations 


American Airlines Flight 587 

On November 12, 2001, American Airlines Flight 587 (AA 587) crashed shortly after take-off killing all 
260 people on board and 5 people on the ground. During the final few seconds of flight, the composite vertical tail of 
the aircraft was overloaded and separated from the fuselage resulting in loss of control and ultimately the loss of the 
aircraft. 


Several teams at LaRC were assembled to assist the National Transportation Safety Board (NT SB) with 
this investigation. The LaRC team was divided into several discipline teams including a structural analysis team 
that consisted of a global analysis team and a detailed lug analysis team. The global analysis team considered global 
deformations, load transfer, and failure modes within the composite vertical tail as well as failure of the composite 
rudder. The detailed lug analysis team focused on failure of the laminated composite lugs that attached the tail to the 
aluminum fuselage. 

The cause of the accident was determined to be the in-flight separation of the vertical tail of the aircraft, 
an Airbus A300-600R. As described in the NTSB report on the accident, the vertical tail separation was the result 
of loads beyond the design ultimate load that were created by the first officer’s unnecessary and excessive rudder 
pedal inputs. Figure 1 shows the vertical tail of the aircraft 2 as well as the results of the analysis of the initial failure 
site (i.e., the right rear lug, one of the six carbon/epoxy composite lugs that connected the vertical tail to the 
fuselage). 

The loads experienced by the lug were evaluated using global models of the vertical tail, local models near 
the lug, and a global-local analysis procedure. 3 The continuum progressive failure analysis (PFA) used to predict 
failure of the local lug model was originally developed as part of the NASA Advanced Subsonic Technology 
(ACT) program and was modified for this investigation. 3 The analysis predicted the location of failure in the lug 
under loading representative of an Airbus certification test conducted in 1985 (the 1985-certification test). The 
analysis was then used to analyze both a subcomponent test conducted by Airbus in 2003 as part of the 
investigation (the 2003 -subcomponent (SC) test) and the (W375) accident condition. Excellent agreement was 
observed between the predicted and observed failure loads and moments for the both 1985-certification test and the 
2003 -subcomponent test. Additionally, the predicted failure loads (Figure 2a) and moments (Figure 2b) for the 
1985-certification and 2003 -subcomponent tests agree well with the predictions for the accident condition, 
indicating that the testing and analysis conducted during the investigation represented the accident condition 
accurately. The failure mode of the right rear lug for the 1985 -certification test, 2003 -subcomponent test, and the 
accident load case is identified as a cleavage-type failure as shown in Figure 1. For the accident case, the predicted 
failure load for the (right rear) lug from the PFA was greater than 1.98 times the limit load of the lug showing that 
the structure performed as intended. This investigation helped to develop an understanding of the capabilities of 
both global-local analysis methodologies and progressive failure analyses in a real-world context. 




Extensive Damage 


Progressive Failure Analysis Results 
- Right Rear Lug 


Figure 1 : Laminated Composite Lug Failure on American Airlines Flight 587 
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Figure 2a: Resultant Force F Res Variation for 1985- 
Certification Test, 2003 -Subcomponent (SC) Test and 
W375 Accident Case. 


Load Factor 

Figure 2b: Bending Moment M x Variation 

for 1985-Certification Test, 2003 -Subcomponent (SC) 

and W375 Accident Case. 


X-33 liquid hydrogen tank 

When the X-33 sandwich-composite liquid hydrogen (LH2) tank failed during a proto flight structural 
proof test in November 1999 as shown in Figure 3, a team of engineers and support personnel, representing NASA 
and its contractors, was called on to support the ensuing failure investigation. Teflon® tape, discarded from the 
manufacturing process, was found at the interface between the facesheet and core and was hypothesized to have 
initiated a debond. The debond was then hypothesized to be driven by internal pressure resulting from 
cryopumping of LH2 into the sandwich core that later expanded from the liquid phase to the gaseous phase as the 
tank warmed after being drained of cryogenic liquid. 

The analysis team performed a fracture mechanics assessment of the debond region using another tool that 
has been extensively developed during NASA research programs, the virtual crack closure technique (VCCT) 4,5 . 
Figure 4 is a plot of calculated mode I strain energy release rate (G/) versus internal pressure within the honeycomb 
sandwich core of the tank wall. Also seen in Figure 4 are the mean, lowest measured, and lowest statistically 
possible (3 a variation) values of the core-to-facesheet bondline toughness ( G cr ) as determined by single cantilever 
beam tests. Because the J-shaped foreign object debris (FOD) crossed the cells of the honeycomb core as shown in 
the insert in the figure, making it impossible to determine the debond width, G-values were computed for three 
“effective” widths as shown in the figure. The VCCT-based fracture mechanics analyses showed that a 
combination of internal core pressure, low core-to-facesheet toughness and a Teflon tape FOD at the bondline, 
were the likely cause of the failure. 6,7 
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Figure 3: Failure of X-33 Sandwich-Composite Liquid Hydrogen Tank 



Pressure, P (psi) 

Figure 4: Fracture Mechanics Prediction of Delamination Growth in X-33 LH2 Tank 


Space Shuttle Columbia carbon/carbon fracture 

The cause of the space shuttle Columbia accident, on February 1, 2003, was attributed to foam being 
liberated from the external tank, impacting the wing leading edge of the space shuttle orbiter during ascent, and 
creating a leak path for hot gases during reentry. Following the Columbia accident, much work throughout NASA 
was focused on understanding the mechanics of foam liberation and on characterizing the damage tolerance of the 
reinforced carbon carbon (RCC) wing leading edge panels of the space shuttle orbiter. 

A crack was found in an RCC panel (see Figure 5) tested at Southwest Research Institute under conditions 
that were believed to be similar to those experienced during the actual impact event. This finding confirmed the 
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hypothesis that insulating foam, traveling at speeds characteristic of the orbiter slipstream, could fracture the RCC. 
Consequently, LaRC staff assessed the potential for propagation of this type of damage during reentry 10 . Fracture 
toughness tests (e.g., compact tension tests) were conducted to characterize the crack growth resistance of the RCC 
material. These values were then used in a fracture mechanics-based shell analysis to predict crack growth in the 
structure. This method worked well to characterize the through-thickness crack damage but was not adequate for 
characterizing more complex damage states as seen in Figure 6. This local damage consisted of matrix cracks, 
delaminations and loss of protective coating. 

To adequately characterize the complex damage shown in Figure 6, a new progressive failure analysis 
subroutine was developed and implemented. The analysis accounted for the unique characteristics of the RCC 
material, including the differing compliance in tension and compression 12 . Results of the analysis were compared 
with the results of open-hole compression and compression after impact test specimens and then used to predict 
damage growth in configurations representative of the wing leading edge. 



Figure 5: Cracking in the Wing Leading Edge Panels after Foam Impact 
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Figure 6: RCC Damage Development Due to Impact 


III. Durability and Damage Tolerance of Aerospace Structures 

Durability and damage tolerance (D&DT) analysis capabilities are critical for use in failure and incident 
investigations and are vital to the design and analysis of future aerospace vehicles. The terminology durability and 
damage tolerance is used throughout the aerospace industry. However, the definitions for D&DT tend to vary 
slightly depending on the organization and indigenous culture. Typical definitions are given by Goranson 13 : 

• Durability: Ability of a structure to sustain degradation from such sources as fatigue, accidental 
damage and environmental deterioration to the extent that they can be controlled by economically 
acceptable maintenance and inspection programs. 

• Damage Tolerance: Ability of a structure to sustain anticipated loads in the presence of fatigue, 
corrosion or accidental damage until such damage is detected through inspections or malfunctions and 
repaired. 

Thus, durability is largely an economic life-cycle design consideration whereas damage tolerance directly addresses 
the structural airworthiness (safety) of the vehicle. Damage-tolerance analyses are performed to determine the 
structure’s ability to continue to function in its intended role after the initiation and possible propagation of damage. 
Moreover, designing for damage tolerance includes selecting materials that are inherently damage resistant, 
identifying sources and types of damage, understanding damage propagation mechanisms, and designing structures 
to operate with some degree of damage. The structure must carry design ultimate load with undetectable damage, 
carry design limit load with detectable damage and must carry minimal flight loads with potentially catastrophic 
damage. 


Often, the requirements for reduced weight and decreased cost are achieved at the expense of D&DT. 
Because of the innovative configurations that are being considered by designers and manufacturers of aerospace 
structures, it is imperative that the D&DT community not only develop more accurate and more computationally 
efficient tools and more extensive experimental capabilities for characterizing damage initiation and growth, but that 
it also dramatically increases the understanding of the fundamental processes that are manifested as structural 
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damage. Development of this understanding is one of the most critical factors in the success of NASA’s visions for 
Aeronautics and Space Exploration. 


Moreover, composite materials have become increasingly prevalent as primary structures in aircraft and 
their use in spacecraft is becoming more prominent because ubiquitous demands for decreased weight continue to 
drive design. As the use of advanced composites increases, these materials are exposed to increasingly hostile and 
challenging environments. Despite their high strength and high stiffness, composites are extremely susceptible to 
unanticipated damage. Damage can result from a number of sources, both during fabrication and during service. 
For example, even seemingly minor impact events can have a dramatic effect on the load carrying capability of thin- 
walled structures. Even so, the aerospace industry has begun to consider design requirements that can only be 
achieved by using novel composite structures, as evidenced by the development of the Composite Crew Module 
(CCM) of the Orion Crew Launce Vehicle 14 . 


Consequently, LaRC continues to develop advanced mechanics-based computational and experimental 
D&DT methodologies 15 to predict, assess, and understand damage within advanced composite materials and 
structures. These D&DT methodologies must address the deleterious effects of changes in material properties and 
the initiation and growth of damage that may occur during the service lifetime of the vehicle. The approach is 
inherently interdisciplinary and is conducted by combining the disciplines of fracture/damage mechanics, structural 
mechanics, materials science, and physics with the goal of developing advanced integrated technology to support the 
development and assessment of the structural integrity of current and next generation aerospace vehicles. 


IV. Lessons Learned 

As discussed in Section II, large-scale failure and incident investigations tend to be more challenging and 
comprehensive than routine engineering inquiries. A brief discussion of methodologies that have been applied to 
address these failure and incident investigations supported by LaRC was presented. In some of the instances 
presented herein, state-of-the-art methods were applied with no modification, while in others, enhanced or 
specialized methods were developed and applied. The computational and experimental methodologies used in these 
investigations included a specialized global/local approach 3 , VCCT methodologies 7 , progressive failure analyses 3 ’ 10 , 
and material characterization tests 10 . As might be expected, there were many important outcomes from these failure 
and incident investigations. These include an improved understanding of the state-of-the-art in experimental and 
analytical methods, design, and manufacturing processes; determination of pitfalls in the state-of-the-art; and 
collection of numerous lessons learned. 

In this section, best practices for robust structures 16 and lessons learned during the course of the 
investigations 3, 7 ’ 10 are discussed. Although one might argue as to whether or not each of these lessons was truly 
learned by the community as a whole, the importance of each is self-evident. The lessons learned are categorized as 
those related to analysis and testing, design, manufacturing and communication and teamwork, each of which are 
discussed in turn. 

Analysis and Testing 

Structural analyses and associated testing are often performed to predict the response of a structure to the 
critical loads and environments that are anticipated during its service life. Typical analyses include investigations of 
fatigue, safe-life and fail-safe considerations. These analyses are important to establish the service life, tolerance of 
the structure to defects, design margins and residual strength. To ensure the reliability of the structure, it is important 
to verify the analysis models and validate the analysis predictions through testing over the anticipated range of their 
use 16 . Lessons learned that are associated with analysis and testing include those that are fundamental to all 
structural mechanics simulations as well as those more complex issues concomitant with large-scale failure 
investigations (see [17]). 

Application of a rigorous and systematic approach is a step towards avoiding some of the potential pitfalls 
inherent in all structural mechanics simulations. This approach includes ensuring that the simulation goals are clear; 
that the correct structural configuration is being modeled; that the coordinate systems, loads, and boundary/interface 
conditions are understood and consistently used; that the appropriate material models are used within their 
prescribed limits; that the structural response is anticipated; and that the mechanics of the problem are understood. 
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The top ten lessons learned from structural mechanics simulations as presented in Ref. 17 are as follows: 

• Knowing how to run a code does not ensure knowledge of the theory behind the code and knowledge of 
what the code does 

• Bigger models do not always yield better quality (higher fidelity) solutions 

• Ensure that your results make common sense; just because a code runs to completion does not mean that 
the code provided correct answers 

• Don’t miss the obvious; even if it is not your job 

• Little things are important; sum of trivia is not trivial - often small details have significant effects on the 
response 

• One size does not fit all - anticipate having to develop several models and use the most appropriate 
analysis tools 

• Understand the sensitivity of your models and results to parametric variations and problem uncertainties 

• Test cases don’t always tell the full story; know what you do know; understand what you don’t know 

• Things come back around; plan your analyses carefully and document your process and results 

• Be the harshest critic of your own simulations; if you don’t believe them, why should anyone else? 

It is critical to employ fundamental analysis skills throughout the analysis and testing process for complex 
composite structures. It is equally critical to employ these skills throughout complex failure investigations. Lessons 
learned that are specific to recent complex failure and incident investigations supported by LaRC have been 
discussed in References 3,7, 10, 16 and 18 and are outlined herein as follows: 

• While many of the computational and experimental capabilities have been developed at a low-to-mid 
technology readiness level (TRL), (i.e., from basic principles to component level application), they may 
not be fully tested and validated for all aerospace applications. Thus, it is imperative that these capabilities 
be further developed to move them to a higher TRL such that the capabilities are available to the aircraft 
and spacecraft designers and analysts for general use. 

• Failure and incident investigations can identify gaps in the state-of-the-art of experimental and 
computational methods. These investigations also identify gaps in technology transfer (e.g., methods to 
software developers to end-user tools). Sufficient resources should be invested to allow for further 
advancements within time and schedule constraints. 

• All design changes must be thoroughly analyzed and tested. 

• Analysis should properly account for all foreseeable ground and flight environments and failure modes. 

• Uncertainties in material properties, structural loads, and environments are contributing factors to failures. 
Validation of material properties, structural loads, and environments through rigorous test campaigns is the 
best method of ensuring reliable structures. 

• Failures during testing must be thoroughly investigated and the root causes of the test anomalies must be 
ascertained and understood. 

• Testing of components requires care. Whenever possible, test hardware should be structurally similar to 
flight hardware. Special attention needs to be given to interfaces and boundaries to ensure that proper 
boundary conditions are imposed on the system or component. 

• Despite advances in analysis techniques, modeling and simulation verification and validation is a vital part 
of insuring the reliability of structural systems. 

• A building-block approach is required for the analysis, design and fabrication of complex structures. 

• Rigorous analysis must include the development of extensive verification and validation procedures for: 

■ Modeling and analysis 

■ Coupon tests, subcomponent tests, component tests, full scale tests, and flight 
tests 

■ Analysis and test correlation. 


Design 


Primary and secondary structures of aerospace systems are designed to provide sufficient strength, rigidity, 
and other characteristics that are required to sustain critical loading conditions without damage or degradation of 
performance throughout their service life. Critical issues that must be addressed to ensure properly designed 
structures include structural integrity requirements, fatigue and fracture control, factors of safety, material 
properties, and damage tolerance requirements 16 . 
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Aerospace structural systems are complex and have multiple interacting components. As such, these 
structural systems can only be developed through a complex iterative design process 19 . Various best practices that 
lead to the development of reliable and robust spacecraft structures have been reviewed 16 and lessons learned have 
been accumulated. The best practices and lessons learned follow: 

• The design/development approach must integrate materials, structures and manufacturing technologies. 

• The building-block development approach for design, manufacturing scale-up, and test of composite 
structures must be used. 

• In-depth reviews by experienced practitioners (i.e., external peer reviewers) should be used throughout the 
process to ensure that all issues are addressed. In order to alleviate design issues and potential failure 
occurrences, these reviews should be at the design level as well as the formal review level. Early expert 
reviews have the greatest effect on successful investigations as well as on mission success. 

• Document engineering requirements as clearly as possible. All requirements, including seemingly minor 
changes, should be clearly documented and tracked in order to avoid misinterpretation. 

• In a totally new system, requirements may have to be continually reviewed for applicability. Requirements 
may have changed as a result of trade studies or design maturity and must be considered. 

• Aerospace systems are designed to withstand worst-case life-cycle environments; however, any structure 
can fail when subjected to load cases for which it is not designed. Thus, the credibility of mission failure 
scenarios is vital to the evaluation of potential failure modes of the structure. 


Manufacturing 

The design of advanced structures requires well-characterized fabrication processes and procedures. The 
fabrication process for each structural item is a controlled, documented process. Proven processes and procedures 
for fabrication and repair are needed to preclude damage or material degradation during material processing and 
manufacturing operations. An inspection plan is required to identify all key process parameters essential for design 
verification. In-process inspection or process monitoring are needed to verify setup and acceptability of critical 
parameters during the manufacturing process 16 . Several lessons learned related to manufacturing are as follows: 

• Scale-up is manufacturing and test intensive. 

• Nondestructive evaluation (NDE) techniques of complex structures are generally inadequate to detect 
damage during typical in-service inspections. 

• Assembly of a very large structure is difficult and is laden with complexities that are not seen in small 
structures. Thus, special care must be taken to avoid unintended, and possibly undetected, damage or 
introduction of defects. 

Communication and Teamwork 

Camarda 18 outlined a strategy for developing teams to address complex multidisciplinary problems and to 
develop solutions to those problems creatively and rapidly at minimum cost. While the focus of the discussion in the 
reference was on innovative design, critical thinking, and systems engineering, the strategy presented is equally 
applicable to complex failure and incident investigations. The design or investigation process begins with a very 
broad multidisciplinary view of the system and the constraints. A review of all background information that is 
required to obtain a complete understanding of the problem and an assessment of the critical discipline skills 
necessary to solve the problem must follow. The next step is the development of a team that is of suitable size to 
have all skills required to solve the problem and complete the job within schedule and budget constraints. Once a 
team is formed, it is important to develop an environment for collaboration, learning, efficient communication, 
teamwork, respect, reward, and recognition, and that has the necessary tools for encouraging creative thought and 
problem solving available. Hence, high-performing multidisciplinary teams that are dedicated to solving creatively 
complex engineering problems should be developed. Communication is key to the successful operations of these 
teams. 


V. Concluding Remarks 

During the past decades, NASA Langley Research Center (LaRC) has been called upon to support several 
large-scale failure and incident investigations and numerous requests for engineering consultations. Although 
various extenuating circumstances contributed to each of the incidents discussed in this paper, in each of the three 
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cases presented, the failure resulted from accumulation and/or propagation of damage that reduced the load carrying 
capability of the structure to a level below that which was needed to sustain structural loads. A series of lessons 
learned was captured to increase the level of insight that may be developed from the investigations. 

A brief discussion of some of the computational and experimental methodologies that have been applied 
to address these recent failure and incident investigations was presented. The computational and experimental 
methodologies used in the investigations included a specialized global/local approach, state-of-the-art virtual crack 
closure technique (VCCT) methodologies, specialized or enhanced progressive failure analyses, and new material 
characterization tests. An important outcome of many of these failure and incident investigations is the 
development of an improved understanding of not only the state-of-the-art in experimental and analytical methods 
but also the state-of-the-art in the design and manufacturing processes that may contribute to such failures. 

Several general comments can be made regarding the state of durability and damage tolerance (D&DT) 
practices. Often, the requirements for reduced weight and decreased cost are achieved at the expense of D&DT. 
Satisfying advanced durability and damage tolerance design and analysis requirements is very challenging and 
requires expertise in failure mechanics, fracture mechanics, structural mechanics, materials science, and physics to 
guide the experimental and analytical work. Continued development of advanced mechanics-based computational 
and experimental D&DT methodologies are needed to predict, assess, and understand damage within advanced 
materials and structures. 

The lessons learned from the failure and incident investigations presented herein are categorized as those 
related to analysis and testing, design and manufacturing and communication and teamwork. Failure and incident 
investigations can identify gaps in the state-of-the-art experimental methods. In addition, gaps may be identified in 
technology transfer. Thus, a critical lesson learned was that while many of the computational and experimental 
capabilities have been developed at a low-to-mid technology readiness level (TRL), (i.e., from basic principles to 
component level application), they are not fully developed for all aerospace applications. Thus, it is imperative that 
these capabilities be developed further to move to a higher TRL such that the capabilities are available to the aircraft 
and spacecraft designers and analysts for ready use in failure and incident investigations. In addition, it is imperative 
that the lessons learned are disseminated such that they can be built upon in other investigations and in ensuing 
research and development activities. 
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